langchain-ai/langsmith-sdk Security Advisories | GitStock

high2026-06-19

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

GHSA-f4xh-w4cj-qxq8

high2026-05-13

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

GHSA-3644-q5cj-c5c7 · CVE-2026-45134

medium2026-04-16

LangSmith SDK: Streaming token events bypass output redaction

GHSA-rr7j-v2q5-chgv · CVE-2026-41182

medium2026-04-10

LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

GHSA-fw9q-39r9-c252 · CVE-2026-40190

medium2026-02-09

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

GHSA-v34v-rq6j-cj6p · CVE-2026-25528